Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Adjust License Diff to account for License Category #71

Closed
steven-esser opened this issue Feb 20, 2018 · 19 comments
Closed

Adjust License Diff to account for License Category #71

steven-esser opened this issue Feb 20, 2018 · 19 comments
Assignees
@johnmhoran
Labels
enhancement needs design refactoring
Milestone
1.0.0 Re-Release

Comments

@steven-esser
Copy link
Contributor

Auditors care more about Copyleft and Proprietary licenses showing up in a codebase. We need to adjust our scoring so that more emphasis is give to:

  • 'no license' -> 'copyleft limited or higher'
  • 'permissive' -> 'copyleft limited or higher'
  • 'anything -> 'proprietary/commercial'

There are probably other combinations here as well.
@steven-esser steven-esser added this to the 1.1.0 Release milestone Feb 20, 2018
@steven-esser
Copy link
Contributor Author

You may want to break this up into small tickets if needed.

@johnmhoran johnmhoran mentioned this issue Mar 1, 2018
Closed
@johnmhoran johnmhoran mentioned this issue Mar 8, 2018
Merged
@johnmhoran
Copy link
Member

@MaJuRG @DennisClark I'm looking for several large codebases to test my license-change detection work and thought the recent Facebook change to its React licensing might be useful.

Testing react-16.0.0 against react-15.6.1, it appears from the DeltaCode output that the license in question might have the ScanCode key facebook-patent-rights-2 (category: Permissive). However, if I paste that key into a DejaCode Licenses search, the only license returned is antlr-pd.

  • Is facebook-patent-rights-2 not listed in DejaCode, or (perhaps more likely) am I searching incorrectly?
  • Assuming the license in question is in fact facebook-patent-rights-2, I'm curious why we treat it as Permissive when it created such an uproar.
  • Last but not least, can you suggest one or two codebases in which there were changes from Permissive (or no license at all) to Copyleft Limited, Copyleft or some other more-restrictive license?

@DennisClark
Copy link
Member

@jmhoran once again, scancode is “ahead of” dejacode. Please create a new license request in DejaCode.

@johnmhoran
Copy link
Member

@DennisClark Is that done by opening a new issue and assigning the label license_library?

@steven-esser
Copy link
Contributor Author

@johnmhoran that license may not be in DejaCode, or if it is, it is under a slightly different name.

As far as single projects that change from permissive to copyleft, I do not know many off the top of my head. You may have to craft these specific examples.

@johnmhoran
Copy link
Member

@MaJuRG Thanks -- will do. And thanks as well re how to create a license request.

@johnmhoran
Copy link
Member

@MaJuRG I'm in DejaCode -- is the license request submitted through the https://dejacode.zendesk.com/hc/en-us/requests/new URL (a "Submit a request" form)?

@steven-esser
Copy link
Contributor Author

No, go here: https://enterprise.dejacode.com/requests/

@johnmhoran
Copy link
Member

Thanks @MaJuRG -- request submitted.

@johnmhoran
Copy link
Member

@MaJuRG In one of your three examples above, 'permissive' -> 'copyleft limited or higher', how do you want to treat the delta if the old file has both 'permissive' and 'public domain'? They seem sufficiently similar in contrast to the 'copyleft limited or higher' group that I suggest we modify this to 'permissive' and/pr 'public domain' -> 'copyleft limited or higher'.

What do you think?

@johnmhoran
Copy link
Member

johnmhoran commented Mar 13, 2018 •
edited
Loading

FYI, I'm currently treating the following as comprising the categories of particular interest from among the license categories in DejaCode:

'Commercial'
'Copyleft'
'Copyleft Limited'
'Free Restricted'
'Patent License'
'Proprietary Free'

The remaining two categories are 'Permissive' and 'Public Domain'.

I'm interpreting 'copyleft limited or higher' as including all of the notable categories, and 'proprietary/commercial' as meaning 'Commercial' and 'Proprietary Free'. Let me know if this is not consistent with your intent.

@steven-esser
Copy link
Contributor Author

steven-esser commented Mar 13, 2018 •
edited
Loading

Yes, we should treat permissive and public domain the same.

we should "point out" (increase the score) all other cases.

@johnmhoran
Copy link
Member

Thanks @MaJuRG .

@johnmhoran
Copy link
Member

@MaJuRG Do we want to increase the score for each problematic license category that is added (e.g., one incremented score for 'Copyleft', no matter how many different licenses of this category are added), or increment for each unique license of a problematic category (e.g., 'gpl-2.0' and 'gpl-1.0-plus' ==> two score increments)? Thus far I've been taking the former approach.

@steven-esser
Copy link
Contributor Author

Your way is correct.

@johnmhoran
Copy link
Member

👍

@johnmhoran
Copy link
Member

@MaJuRG I'm about to push a commit for your vetting -- more tests to follow.

johnmhoran added a commit that referenced this issue Mar 14, 2018
@johnmhoran
Account for license categories #71
d4183dc 
  * Modify DeltaCode.license_diff() to detect and identify the addition
    of certain categories of licenses.
  * Refactor scoring structure and methods to discard use of score for
    delta identification.
  * Modify sorting of delta results: by score descending, then
    alphabetically ascending.
  * Modify utils.deltas() to adjust to refactored scoring structure.
  * Add File.licenses_is_empty() and File.copyrights_is_empty() methods.
  * Add Delta.is_modified() and Delta.is_unmodified() methods.
  * Fix failing tests, add tests.

Signed-off-by: John M. Horan <johnmhoran@gmail.com>
@johnmhoran
Copy link
Member

@MaJuRG Push coming shortly. I've been able to substantially simplify the category-change detection while retaining all three of our new rules, i.e., incrementing Delta.score and supplementing Delta.factors when:

  • no license ==> 'Copyleft Limited' or higher
  • 'Permissive' or 'Public Domain' ==> 'Copyleft Limited' or higher
  • anything ==> 'Proprietary Free' or 'Commercial'

For clarity, I've also added comments in the code indicating where each of these rules is implemented.

johnmhoran added a commit that referenced this issue Mar 16, 2018
@johnmhoran
Refactor license category detection/scoring #71
b2bc80f 
  * Clarify Delta sorting.
  * Simplify set creation.
  * Simplify implementation of category-change detection.
  * Rename methods.
  * Fix failing tests, add new test codebases and tests.

Signed-off-by: John M. Horan <johnmhoran@gmail.com>
johnmhoran added a commit that referenced this issue Mar 16, 2018
@johnmhoran
Finish refactoring category-change detection #71
3daeb19 
  * Stop sorting in category-change process, and modify related tests to
    compare lists that may have dissimilar ordering.
  * Remove rule: anything ==> 'Proprietary Free' or 'Commercial'.

Signed-off-by: John M. Horan <johnmhoran@gmail.com>
@steven-esser
Copy link
Contributor Author

merged #86, closing

arnav-mandal1234 pushed a commit to arnav-mandal1234/deltacode that referenced this issue Mar 16, 2023
@pombredanne
Merge pull request aboutcode-org#71 from swastkk/packvers-added
5be2690 
Replace packaging with packvers in src/scripts
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@johnmhoran johnmhoran

Labels
enhancement needs design refactoring
Projects
None yet
Milestone
1.0.0 Re-Release
Development

No branches or pull requests
3 participants
@DennisClark @steven-esser @johnmhoran